OFFICIAL 


Our Ref: IM-FOI-2019-0324 

Date: 2 May 2019 

POLICE 

SCOTLAND 

Keeping people safe 



FREEDOM OF INFORMATION (SCOTLAND) ACT 2002 - INTERNAL REVIEW 

In accordance with section 20(1) of the Freedom of Information (Scotland) Act 2002, I 
understand that you have requested a review of the decision communicated to you on 7 
March 2019 in respect of your original request for information, received 6 February 2019. 

Please accept my apologies for the delay in providing a response. 


Original Request 

1. I would like to know how many of the following types of devices have been 
subject to data extraction or some other kind of digital forensic investigation in 
the 2017 and 2018 calendar years: 

* Mobile phones 

* Desktop computers 

* Laptop computers 

* Tablets 

* External hard drives or storage devices 

* Other digital devices 

3. Please confirm how much has been spent on specialist hardware and software to 
facilitate digital forensic investigation activities in each calendar year. Please 
break this expenditure down by supplier / product. 

Request for Review 

I am writing to request an internal review of Police Scotland's handling of my FOI 
request 'Digital device analysis'. 

I am disappointed that Police Scotland provided so little information with regards to 
this request. In particular, I would be keen to receive some information on the 
numbers of devices analysed. 

I note that Police Scotland were previously able to provide this information. A 
previously submitted FOI request, using similar wording to this one, did result in the 
release of information. If it is possible to release updated figures that are 
comparable with the data released in previous years, I would be grateful if you could 
consider doing so link provided 

With regards to Q3 of my FOI, I note for example, that you have previously released 
some details pertaining to Police Scotland use of Cellebrite tools link provided 

In light of these precedents, please review the entire initial response to my FOI 
request and consider whether it is possible to release more information. 
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My role is to consider the response issued and determine whether or not your request was 
handled in accordance with the provisions of the Freedom of Information (Scotland) Act 
2002 . 

As part of the review, I am also required to consider the quality of the administrative 
process applied to your request and I note that your request was not responded to by the 

20 working day legislative deadline. 

The Force has therefore clearly failed on this occasion with regard to this legislative 
obligation and for that I apologise. 

In reviewing the response I have studied all documentation relevant to the request, 
including that which documents both the research carried out and the decision making 
process. 

The decision I have to make is whether or not section 12 of the Act was correctly applied 
to question one of your request and whether or not section 17 of the Act was correctly 
applied to question three of your request. 

Consideration of Police Scotland Response to Question One: 

Flaving consulted with colleagues in our Cybercrime Policy and Coordination Unit I can 
confirm that the case management system introduced in 2016 categorises all forms logged 
as either ‘phone’ or ‘computer’ and they are not thereafter subcategorised in terms of any 
search capability. 

I am advised that it’s wholly possible that the form will be marked as a ‘phone’ case but 
also contain computer related devices and vice versa. 

To be of assistance however, I can advise that for 2017, there were 5,270 forms 
categorised in the system as ‘phone’ and 1,660 categorised as ‘computer’. 

For 2018 there were 5,520 forms categorised in the system as ‘phone’ and 1,240 
categorised as ‘computer’. 

At a conservative estimate of three minutes per form to review the content in terms of 
devices submitted and note the detail, conducting this exercise is estimated to involve 685 
hours of work - equating to a cost (at £15 per hour) of £10,275. 

Taking all of the above into account, I am satisfied that your request has been handled in 
accordance with the Freedom of Information (Scotland) Act 2002 and in terms of section 

21 (4)(a) of the Act, I uphold the original response and agree that section 12 of the Act was 
correctly applied. 
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Consideration of Police Scotland Response to Question Three: 

Having consulted with colleagues in our Cybercrime Policy and Coordination and Finance 
Units, I must conclude that there is information of relevance held in relation to your 
request. 

I have consulted the finance records in relation to the Cybercrime Policy and Coordination 
Unit and, in particular, the spend logged under the category of ‘IT purchase’. 

It is not impossible that other costs will have been incurred that may be of relevance to 
your request but without going through the ‘IT purchase’ records of every department of 
Police Scotland it is impossible to say. 

Taking all of the above into account, I am not satisfied that your request has been handled 
in accordance with the Freedom of Information (Scotland) Act 2002 and in terms of section 
21 (4)(b) of the Act, I overturn the original response as I do not agree that section 17 of the 
Act was correctly applied. 

Whether these items could be classed as ‘specialist’ however, as per the terminology used 
in your request, or whether the purpose is to ‘facilitate digital forensic investigation 
activities’ is a matter of subjective assessment. 

Notwithstanding, I can provide you with the following information: 

2016/17 ‘IT Purchase’ spend: 

£24,499.12 

(This figure takes account of a credit of £870.36 which relates to an adjustment for costs 
incurred in the 2015/16 financial year) 

Recorded suppliers: 

AVATU ltd 
Cellebrite 

Computacenter United Kingdom ltd. 

DELL Computer Corporation ltd 
Digital Detective Group 
HP Inc. UK ltd 
INSIGHT Direct UK ltd 
MISCO UK ltd 

Vector & Scalar Products ltd 

Recorded product descriptions: 

Tableau Supertkit 
Tableau - T35u 

Dell Precision Tower 7910 Xcto Option 1 

Intel X520 Dp lOgb Da/Sfp+ Server Adapter,Ful 

Sfp+, lOgbe Sr/Sx, Optical Transceiver, Lc Co 

Seagate Constellation Es.3 St1000nm0033 Hard 

Alienware 17 R4 Laptop 

Netanalysis V2x - Forensic Recovery Suite (Us 
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Hardware purchase 

Trade In From Ufed Touch 1 Toufed4pc With Kit 
Hgst Ultrastar 7k4000 Hus724030ale640 Hard Dr 
242 Hp Elite Display E242 Hight Adjstable Ips 
24" Hp Elite Display E242 Hight Adjstable Ips 
23" Led Monitor (2553211) - Input Requirement 
Seagate Barracuda 3tb 3.5 Sataiii Internal Ha 
Seagate Constellation Es 4tb 3.5 Sata Int - S 
Seagate Barracuda 3tb 3.5 Sataiii Internal Ha 
Seagate Barracuda 3tb 3.5 Sataiii Internal Ha 
Seagate Expansion 1 tb Portable - 2492818 
Wd Av Green 1 tb 3.5 Sata Int Hd - 193912 
Wd Av Green 1 tb 3.5 Sata Int Hd - 193912 
Encase Forensic 8 & Encase Portable v4 
Payment of invoice 
2 x Hard Drives 


2017/18 ‘IT Purchase’ spend 

£334.80 

(This figure takes account of a credit of £885.91 which relates to an adjustment to 
centralise all ICT related costs) 

Recorded suppliers: 

MISCO UK ltd 
WEX Photographic 
IANSYST ltd 

Recorded product descriptions: 

128gb Microsdxc Read Card 
Service-Prospec Usb 3.0 Multi-Card Reader 
Service-Prospec Usb 3.0 Multi-Card Reader 
Read And Write Gold Atw V11.5 Mobile (Rwg-11 - 
Read And Write Gold Atw V11.5 Single (Rwg-11. 

Mindgenius Business V6 Single (Mbu-V6-01) - A 


In terms of Section 16 of the Freedom of Information (Scotland) Act 2002 I am refusing to 
provide you with an itemised list per product/ supplier. 

Section 16 requires Police Scotland when refusing to provide such information because it is 
exempt, to provide you with a notice which: 

(a) states that it holds the information, 

(b) states that it is claiming an exemption, 

(c) specifies the exemption in question and 

(d) states, if that would not be otherwise apparent, why the exemption applies. 

I can confirm that Police Scotland holds the information that you have requested. 
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The exemption that I consider to be applicable to the information requested by you is set out 
at section 33(1 )(b) - commercial interests: 

Information is exempt information if its disclosure under this Act would, or would be likely to, 
prejudice substantially the commercial interests of any person. 

The information held relates to the provision of goods and services to Police Scotland from 
third party suppliers, the disclosure of which would, in my view, lead to a commercial 
detriment to both parties. 

Whilst there is a public interest in better informing the public as to the financial activities of 
Police Scotland and the companies involved, there can be no parallel interest in the 
disclosure of information which would lead to the commercial interests of Police Scotland 
or any third party being jeopardised. 

On balance, the public interest must lie in ensuring that companies can trust in Police 
Scotland not to disclose information which would render them less able to compete in the 
open market. 


Should you require any further assistance concerning this matter please contact 
Information Management - Dundee quoting the reference number given. 

If you remain dissatisfied following the outcome of this review, you are thereafter entitled to 
apply to the Office of the Scottish Information Commissioner within six months for a decision. 
You can apply online , by email to enquiries@itspublicknowledqe.info or by post to Office of 
the Scottish Information Commissioner, Kinburn Castle, Doubledykes Road, St Andrews, 
Fife, KYI 6 9DS. 

Should you wish to appeal against the Office of the Scottish Information Commissioner's 
decision, there is an appeal to the Court of Session on a point of law only. 
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